Kontrola logu Vyřešeno

[Damned]

Tak ho smázneme:
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\HideWin.exe


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[Reklama]

[Damned]

Až to budeš mít tak:
Start->Spustit a napiš msconfig a stiskni OK. Zjeví se ti konfigurační nástroj a na záložce BOOT.INI by si měl mít POUZE toto:

[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /usepmtimer

[miruska27]

Tady jsou obe logy...
Tam jak píšeš je to skoro stejné,je tam navíc jeden řádek,nejde zkopírovat,napíšu:C:/CMDCONS/BOOTSECT.DAT="Microsoft Windows Recovery Console/cmdcons s tím,že ty první dvě lomítka jsou obrácené


ComboFix 09-05-22.05 - Mirek 23.05.2009 10:12.6 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1465 [GMT 2:00]
Spuštěný z: c:\documents and settings\Mirek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Mirek\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 8.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}

FILE ::
c:\windows\HideWin.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Mirek\LOCALS~1\Temp\sfamcc00001.dll
c:\docume~1\Mirek\LOCALS~1\Temp\sfareca00001.dll
c:\documents and settings\Mirek\Local Settings\temp\sfamcc00001.dll
c:\documents and settings\Mirek\Local Settings\temp\sfareca00001.dll
c:\windows\HideWin.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-04-23 do 2009-05-23 )))))))))))))))))))))))))))))))
.

2009-05-18 12:54 . 2009-05-18 12:54 -------- d-----w c:\windows\system32\windows media
2009-05-18 12:53 . 2009-05-18 12:54 -------- d--h--w c:\windows\msdownld.tmp
2009-05-18 12:53 . 2009-05-18 12:53 -------- d-----w c:\program files\Windows Media Components
2009-05-15 11:07 . 2009-05-15 11:07 -------- d-----w c:\windows\system32\AGEIA
2009-05-15 11:07 . 2009-05-15 11:07 -------- d-----w c:\program files\AGEIA Technologies
2009-05-15 11:07 . 2009-05-15 11:07 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-13 10:43 . 2009-05-13 10:43 552 ----a-w c:\windows\system32\d3d8caps.dat
2009-05-11 15:40 . 2009-02-25 13:15 593920 ------w c:\windows\system32\ati2sgag.exe
2009-05-11 15:39 . 2009-05-11 15:39 -------- d-----w c:\program files\ATI Technologies
2009-05-11 15:08 . 2009-05-11 15:08 262144 ----a-w c:\windows\system32\wrap_oal.dll
2009-05-11 15:08 . 2009-05-11 15:08 86016 ----a-w c:\windows\system32\OpenAL32.dll
2009-05-11 15:08 . 2004-06-22 13:44 5632 ----a-w c:\windows\system32\drivers\Entech64.sys
2009-05-11 15:08 . 2004-10-25 18:02 21664 ----a-w c:\windows\system32\drivers\Entech.sys
2009-05-11 15:08 . 2009-05-11 15:08 -------- d-----w c:\windows\system32\Futuremark
2009-05-11 15:07 . 2009-05-18 12:54 -------- d-----w c:\program files\Futuremark
2009-05-04 21:34 . 2009-05-05 06:20 -------- d-----w c:\program files\DreamCom SE
2009-05-03 19:08 . 2008-12-18 14:02 1051136 ----a-w c:\windows\system32\drivers\CAMTHWDM.sys
2009-05-03 19:08 . 2009-05-03 19:08 -------- d-----w c:\program files\WebcamMax
2009-05-03 18:21 . 2009-05-03 18:21 230432 ----a-w C:\PA7302.DAT
2009-05-03 10:20 . 2009-05-23 07:58 -------- d-----w c:\program files\SpeedFan
2009-05-03 10:15 . 2009-05-15 11:11 -------- d-----w c:\windows\nview
2009-05-03 10:15 . 2009-03-27 08:03 453152 ----a-w c:\windows\system32\nvudisp.exe
2009-05-03 10:15 . 2009-03-27 06:14 453152 ----a-w c:\windows\system32\NVUNINST.EXE
2009-05-02 09:17 . 2009-05-02 09:17 -------- d-----w c:\program files\Common Files\PCSuite
2009-05-02 09:17 . 2009-05-02 09:17 -------- d-----w c:\program files\Common Files\Nokia
2009-05-02 09:16 . 2008-08-26 08:26 18816 ----a-w c:\windows\system32\drivers\pccsmcfd.sys
2009-05-02 09:16 . 2009-05-02 09:16 -------- d-----w c:\program files\PC Connectivity Solution
2009-04-30 14:38 . 2009-04-30 14:38 -------- d-----w C:\instal
2009-04-30 14:34 . 2009-04-30 14:34 -------- d-----w C:\EVEREST Ultimate
2009-04-28 13:59 . 2009-04-28 13:59 -------- d-----w C:\ATI
2009-04-27 09:54 . 2009-04-27 09:54 -------- d-----w c:\program files\MadOnion.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-23 05:33 . 2009-03-29 10:31 -------- d-----w c:\program files\F-Secure
2009-05-18 14:37 . 2009-03-23 19:33 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-04 21:43 . 2009-03-23 22:16 -------- d-----w c:\program files\Krtecek
2009-05-02 22:14 . 2009-03-31 19:37 -------- d-----w c:\program files\SweetIM
2009-05-02 09:17 . 2009-03-23 22:50 -------- d-----w c:\program files\Nokia
2009-04-28 14:01 . 2009-03-23 19:33 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-15 08:53 . 2001-10-25 14:00 90414 ----a-w c:\windows\system32\perfc005.dat
2009-04-15 08:53 . 2001-10-25 14:00 459802 ----a-w c:\windows\system32\perfh005.dat
2009-04-13 19:45 . 2009-04-13 19:45 -------- d-----w c:\program files\Secunia
2009-04-10 20:56 . 2009-03-23 21:47 -------- d-----w c:\program files\ESET
2009-04-08 15:25 . 2009-04-08 15:25 -------- d-----w c:\program files\Logitech
2009-04-06 23:00 . 2009-03-30 19:00 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-06 16:21 . 2009-04-06 16:21 -------- d-----w c:\program files\MSXML 4.0
2009-04-06 14:06 . 2009-04-06 13:23 -------- d-----w c:\program files\Common Files\Ahead
2009-04-06 13:40 . 2009-04-06 13:40 -------- d-----w c:\program files\DVD Shrink
2009-04-06 13:39 . 2009-04-06 13:38 -------- d-----w c:\program files\DVD Decrypter
2009-04-06 13:32 . 2009-03-30 19:00 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2009-03-30 19:00 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-06 13:23 . 2009-04-06 13:23 -------- d-----w c:\program files\Nero
2009-04-06 13:09 . 2009-04-06 13:09 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-04-06 13:09 . 2009-04-06 13:09 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-03-31 19:29 . 2009-03-31 19:15 33408 ----a-w c:\windows\system32\drivers\fsbts.sys
2009-03-31 19:24 . 2009-03-31 16:17 -------- d-----w c:\program files\Java
2009-03-30 16:59 . 2009-03-30 16:59 -------- d-----w c:\program files\Trend Micro
2009-03-28 22:22 . 2009-03-28 22:22 -------- d-----w c:\program files\VSO
2009-03-27 23:18 . 2009-03-25 19:27 -------- d-----w c:\program files\AVS4YOU
2009-03-26 16:15 . 2009-03-23 21:06 -------- d-----w c:\program files\DVDFab 5
2009-03-25 19:28 . 2009-03-25 19:28 -------- d-----w c:\program files\Common Files\AVSMedia
2009-03-25 16:41 . 2009-03-25 16:41 -------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-03-25 16:41 . 2009-03-25 16:41 -------- d-----w c:\program files\DVDVideoSoft
2009-03-24 11:03 . 2009-03-24 11:03 7808 ----a-w c:\windows\system32\drivers\psi_mf.sys
2009-03-24 08:49 . 2009-03-24 08:44 -------- d-----w c:\program files\ICQ6.5
2009-03-23 21:06 . 2009-03-23 21:06 47360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-03-23 20:46 . 2009-03-23 19:22 86327 ----a-w c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-03-23 20:46 . 2009-03-23 19:22 3038 ----a-w c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2009-03-23 20:30 . 2009-03-23 20:15 664 ----a-w c:\windows\system32\d3d9caps.dat
2009-02-25 21:42 . 2009-02-25 21:42 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-02-25 21:41 . 2009-03-23 20:24 325120 ----a-w c:\windows\system32\ati2dvag.dll
2009-02-25 21:30 . 2009-02-25 21:30 11841536 ----a-w c:\windows\system32\atioglxx.dll
2009-02-25 21:30 . 2009-02-25 21:30 204800 ----a-w c:\windows\system32\atipdlxx.dll
2009-02-25 21:29 . 2009-02-25 21:29 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-02-25 21:29 . 2009-02-25 21:29 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-02-25 21:29 . 2009-02-25 21:29 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-02-25 21:29 . 2009-02-25 21:29 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-02-25 21:27 . 2009-02-25 21:27 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-02-25 21:26 . 2009-02-25 21:26 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-02-25 21:16 . 2009-03-23 20:24 3817984 ----a-w c:\windows\system32\ati3duag.dll
2009-02-25 21:09 . 2009-02-25 21:09 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-02-25 20:59 . 2009-03-23 20:24 2670080 ----a-w c:\windows\system32\ativvaxx.dll
2009-02-25 20:58 . 2009-02-25 20:58 887724 ----a-w c:\windows\system32\ativva6x.dat
2009-02-25 20:58 . 2009-02-25 20:58 3107788 ----a-w c:\windows\system32\ativva5x.dat
2009-02-25 20:44 . 2009-02-25 20:44 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-02-25 20:40 . 2009-02-25 20:40 475136 ----a-w c:\windows\system32\atikvmag.dll
2009-02-25 20:38 . 2009-02-25 20:38 126976 ----a-w c:\windows\system32\atiadlxx.dll
2009-02-25 20:38 . 2009-02-25 20:38 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-02-25 20:37 . 2009-02-25 20:37 53248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-02-25 20:35 . 2009-02-25 20:35 290816 ----a-w c:\windows\system32\atiok3x2.dll
2009-02-25 20:32 . 2009-02-25 20:32 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-02-25 20:32 . 2009-02-25 20:32 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-02-25 20:32 . 2009-03-23 20:24 626688 ----a-w c:\windows\system32\ati2cqag.dll
2009-02-25 20:30 . 2009-02-25 20:30 3227648 ----a-w c:\windows\system32\aticaldd.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-22_23.00.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-23 08:14 . 2009-05-23 08:14 16384 c:\windows\temp\Perflib_Perfdata_6c8.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 1312256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2008-12-04 182936]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2008-12-04 957024]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-03-05 111928]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-11-26 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-11-26 1057064]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2009-01-11 16342528]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-03-27 1657376]

c:\documents and settings\Mirek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-3-24 748840]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-6-7 553021]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [31.3.2009 21:15 33408]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [31.3.2009 21:15 79872]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\F-Secure\HIPS\drivers\fshs.sys [31.3.2009 21:14 67808]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [3.5.2009 21:08 1051136]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [31.3.2009 21:14 84608]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [31.3.2009 21:15 55904]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [24.3.2009 13:03 7808]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\drivers\PAC7302.SYS [8.4.2009 17:25 457856]
S3 ZSMC0305;VIMICRO PC Camera 301DY;c:\windows\system32\Drivers\usbVM305.sys --> c:\windows\system32\Drivers\usbVM305.sys [?]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [31.3.2009 21:14 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [31.3.2009 21:14 25184]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-be ... canner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-23 10:16
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY
*]
"DisplayName"="???\17?\11\09"
"DeviceDesc"="???\17?\11\09"
"ProviderName"="???\11?\17?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"d:\\instalace\\záloha ovladače\\motherboard_driver_chipset_ati_rs690\\smbus\\smbusati.inf\00"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(720)
c:\program files\F-Secure\FSPS\program\FSLSP.DLL

- - - - - - - > 'explorer.exe'(2296)
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\F-Secure\Anti-Virus\fsgk32st.exe
c:\program files\F-Secure\Common\FSMA32.EXE
c:\program files\F-Secure\Anti-Virus\fsgk32.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\F-Secure\Common\FSMB32.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\F-Secure\Common\FCH32.EXE
c:\windows\system32\searchindexer.exe
c:\program files\F-Secure\Common\FAMEH32.EXE
c:\program files\F-Secure\Anti-Virus\fsqh.exe
c:\program files\F-Secure\FSAUA\program\fsaua.exe
c:\program files\F-Secure\Anti-Virus\fssm32.exe
c:\program files\F-Secure\FWES\program\fsdfwd.exe
c:\program files\F-Secure\FSAUA\program\fsus.exe
c:\program files\F-Secure\Anti-Virus\fsav32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\F-Secure\FSGUI\fsguidll.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
.
**************************************************************************
.
Celkový čas: 2009-05-23 10:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-05-23 08:18
ComboFix2.txt 2009-05-23 07:31
ComboFix3.txt 2009-05-23 06:00
ComboFix4.txt 2009-05-22 23:02

Před spuštěním: Volných bajtů: 62 413 774 848
Po spuštění: Volných bajtů: 62 400 167 936

262 --- E O F --- 2009-05-22 18:31



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:35, on 23.5.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\FSAUA\program\fsus.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9971 bytes

[Damned]

Odstraň tedy Konzolu pro zotavení a oprav soubor Boot.ini podle návodu z Nápovědy:

Odstranění konzoly pro zotavení
Otevřete složku Tento počítač.
Poklepejte na pevný disk, na kterém je nainstalována konzola pro zotavení.
V nabídce Nástroje klepněte na příkaz Možnosti složky.
Klepněte na kartu Zobrazit.
Klepněte na přepínač Zobrazit skryté soubory a složky, zrušte zaškrtnutí políčka Skrýt chráněné soubory operačního systému a klepněte na tlačítko OK.
V kořenovém adresáři odstraňte složku \Cmdcons.
V kořenovém adresáři odstraňte soubor Cmldr.
V kořenovém adresáři klepněte pravým tlačítkem myši na soubor Boot.ini a potom klepněte na příkaz Vlastnosti.
Zrušte zaškrtnutí políčka Jen pro čtení a klepněte na tlačítko OK.
Otevřete soubor Boot.ini v programu Poznámkový blok a odstraňte položku konzoly pro zotavení. Položka bude vypadat podobně jako tento řádek:
C:\cmdcons\bootsect.dat="Microsoft Windows Recovery Console" /cmdcons

Uložte a zavřete soubor.
Upozornění

Nesprávné změny souboru Boot.ini mohou zabránit restartování počítače. Přesvědčte se, že jste odstranili pouze položku konzoly pro zotavení.
Poznámky

Složku Tento počítač otevřete klepnutím na tlačítko Start a na příkaz Tento počítač.
Po dokončení tohoto postupu doporučujeme změnit atribut souboru Boot.ini zpět na hodnotu Jen pro čtení. Pravděpodobně budete také chtít znovu skrýt systémové soubory.

[Damned]

Až si to uděláš tak jeětě jeden skript.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

KillAll::
File::
c:\windows\msdownld.tmp

Folder::
c:\windows\msdownld.tmp


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[miruska27]

Hezký den. Složka Cmdcons nejde odstranit - ani v nouzovém režimu. Soubor Cmldr odstranit šel. Co dál??

[miruska27]

Poradí mi někdo prosím? Děkuji předem M*

[Damned]

Nastav výchozí bootování jako na obrázku. Tlačítky Nahoru, Dolů posuň pod [operating systems] a pak to označ jako výchozí:


[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /usepmtimer

Časový interval lze nastavit na 3-999 sekund.


A ještě ten druhý log z ComboFixu.

[miruska27]

ComboFix 09-05-22.05 - Mirek 24.05.2009 15:23:11.7 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1500 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Mirek\Plocha\ComboFix.exe
Použité ovládací přepínače :: C:\Documents and Settings\Mirek\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 8.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}

FILE ::
c:\windows\msdownld.tmp
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\msdownld.tmp

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-04-24 do 2009-05-24 )))))))))))))))))))))))))))))))
.

2009-05-24 08:39:56 . 2009-05-24 08:39:56 0 d-----w C:\Program Files\VS Revo Group
2009-05-24 07:46:35 . 2009-05-24 07:46:39 0 d-----w C:\Documents and Settings\Administrator
2009-05-24 06:39:00 . 2009-05-24 06:39:00 56 ---ha-w C:\WINDOWS\system32\ezsidmv.dat
2009-05-18 12:54:04 . 2009-05-18 12:54:04 0 d-----w C:\WINDOWS\system32\windows media
2009-05-18 12:53:52 . 2009-05-18 12:53:52 0 d-----w C:\Program Files\Windows Media Components
2009-05-15 11:07:38 . 2009-05-15 11:07:38 0 d-----w C:\WINDOWS\system32\AGEIA
2009-05-15 11:07:38 . 2009-05-15 11:07:38 0 d-----w C:\Program Files\AGEIA Technologies
2009-05-15 11:07:20 . 2009-05-15 11:07:21 0 d-----w C:\Program Files\Common Files\Wise Installation Wizard
2009-05-13 10:43:28 . 2009-05-13 10:43:28 552 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2009-05-11 15:40:12 . 2009-02-25 13:15:00 593920 ------w C:\WINDOWS\system32\ati2sgag.exe
2009-05-11 15:39:52 . 2009-05-11 15:39:52 0 d-----w C:\Program Files\ATI Technologies
2009-05-11 15:08:49 . 2009-05-11 15:08:49 262144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2009-05-11 15:08:48 . 2009-05-11 15:08:48 86016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2009-05-11 15:08:29 . 2004-06-22 13:44:50 5632 ----a-w C:\WINDOWS\system32\drivers\Entech64.sys
2009-05-11 15:08:28 . 2004-10-25 18:02:58 21664 ----a-w C:\WINDOWS\system32\drivers\Entech.sys
2009-05-11 15:08:27 . 2009-05-11 15:08:27 0 d-----w C:\WINDOWS\system32\Futuremark
2009-05-11 15:07:42 . 2009-05-18 12:54:36 0 d-----w C:\Program Files\Futuremark
2009-05-04 21:34:14 . 2009-05-05 06:20:20 0 d-----w C:\Program Files\DreamCom SE
2009-05-03 19:08:20 . 2008-12-18 14:02:32 1051136 ----a-w C:\WINDOWS\system32\drivers\CAMTHWDM.sys
2009-05-03 19:08:13 . 2009-05-03 19:08:36 0 d-----w C:\Program Files\WebcamMax
2009-05-03 18:21:55 . 2009-05-03 18:21:56 230432 ----a-w C:\PA7302.DAT
2009-05-03 10:20:15 . 2009-05-24 07:43:13 0 d-----w C:\Program Files\SpeedFan
2009-05-03 10:15:29 . 2009-05-15 11:11:02 0 d-----w C:\WINDOWS\nview
2009-05-03 10:15:29 . 2009-03-27 08:03:00 453152 ----a-w C:\WINDOWS\system32\nvudisp.exe
2009-05-03 10:15:09 . 2009-03-27 06:14:42 453152 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2009-05-02 09:17:25 . 2009-05-02 09:17:25 0 d-----w C:\Program Files\Common Files\PCSuite
2009-05-02 09:17:18 . 2009-05-02 09:17:19 0 d-----w C:\Program Files\Common Files\Nokia
2009-05-02 09:16:26 . 2008-08-26 08:26:12 18816 ----a-w C:\WINDOWS\system32\drivers\pccsmcfd.sys
2009-05-02 09:16:17 . 2009-05-02 09:16:19 0 d-----w C:\Program Files\PC Connectivity Solution
2009-04-30 14:38:06 . 2009-04-30 14:38:10 0 d-----w C:\instal
2009-04-30 14:34:02 . 2009-04-30 14:34:09 0 d-----w C:\EVEREST Ultimate
2009-04-28 13:59:47 . 2009-04-28 13:59:47 0 d-----w C:\ATI
2009-04-27 09:54:09 . 2009-04-27 09:54:09 0 d-----w C:\Program Files\MadOnion.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-23 05:33:05 . 2009-03-29 10:31:10 0 d-----w C:\Program Files\F-Secure
2009-05-18 14:37:52 . 2009-03-23 19:33:42 0 d--h--w C:\Program Files\InstallShield Installation Information
2009-05-04 21:43:21 . 2009-03-23 22:16:45 0 d-----w C:\Program Files\Krtecek
2009-05-02 22:14:26 . 2009-03-31 19:37:43 0 d-----w C:\Program Files\SweetIM
2009-05-02 09:17:19 . 2009-03-23 22:50:30 0 d-----w C:\Program Files\Nokia
2009-04-28 14:01:21 . 2009-03-23 19:33:32 0 d-----w C:\Program Files\Common Files\InstallShield
2009-04-15 08:53:40 . 2001-10-25 14:00:00 90414 ----a-w C:\WINDOWS\system32\perfc005.dat
2009-04-15 08:53:40 . 2001-10-25 14:00:00 459802 ----a-w C:\WINDOWS\system32\perfh005.dat
2009-04-13 19:45:40 . 2009-04-13 19:45:40 0 d-----w C:\Program Files\Secunia
2009-04-10 20:56:17 . 2009-03-23 21:47:22 0 d-----w C:\Program Files\ESET
2009-04-08 15:25:10 . 2009-04-08 15:25:10 0 d-----w C:\Program Files\Logitech
2009-04-06 23:00:44 . 2009-03-30 19:00:05 0 d-----w C:\Program Files\Malwarebytes' Anti-Malware
2009-04-06 16:21:10 . 2009-04-06 16:21:10 0 d-----w C:\Program Files\MSXML 4.0
2009-04-06 14:06:46 . 2009-04-06 13:23:08 0 d-----w C:\Program Files\Common Files\Ahead
2009-04-06 13:40:42 . 2009-04-06 13:40:26 0 d-----w C:\Program Files\DVD Shrink
2009-04-06 13:39:00 . 2009-04-06 13:38:56 0 d-----w C:\Program Files\DVD Decrypter
2009-04-06 13:32:54 . 2009-03-30 19:00:06 38496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32:46 . 2009-03-30 19:00:09 15504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-04-06 13:23:08 . 2009-04-06 13:23:08 0 d-----w C:\Program Files\Nero
2009-04-06 13:09:36 . 2009-04-06 13:09:36 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-04-06 13:09:27 . 2009-04-06 13:09:27 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-03-31 19:29:13 . 2009-03-31 19:15:27 33408 ----a-w C:\WINDOWS\system32\drivers\fsbts.sys
2009-03-31 19:24:55 . 2009-03-31 16:17:55 0 d-----w C:\Program Files\Java
2009-03-30 16:59:23 . 2009-03-30 16:59:23 0 d-----w C:\Program Files\Trend Micro
2009-03-28 22:22:03 . 2009-03-28 22:22:00 0 d-----w C:\Program Files\VSO
2009-03-27 23:18:26 . 2009-03-25 19:27:26 0 d-----w C:\Program Files\AVS4YOU
2009-03-26 16:15:49 . 2009-03-23 21:06:42 0 d-----w C:\Program Files\DVDFab 5
2009-03-25 19:28:14 . 2009-03-25 19:28:01 0 d-----w C:\Program Files\Common Files\AVSMedia
2009-03-25 16:41:32 . 2009-03-25 16:41:25 0 d-----w C:\Program Files\Common Files\DVDVideoSoft
2009-03-25 16:41:25 . 2009-03-25 16:41:25 0 d-----w C:\Program Files\DVDVideoSoft
2009-03-24 11:03:08 . 2009-03-24 11:03:08 7808 ----a-w C:\WINDOWS\system32\drivers\psi_mf.sys
2009-03-23 21:06:46 . 2009-03-23 21:06:46 47360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2009-03-23 20:46:54 . 2009-03-23 19:22:48 86327 ----a-w C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\index.dat
2009-03-23 20:46:54 . 2009-03-23 19:22:46 3038 ----a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2009-03-23 20:30:22 . 2009-03-23 20:15:24 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat
2009-02-25 21:42:32 . 2009-02-25 21:42:32 442368 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2009-02-25 21:41:10 . 2009-03-23 20:24:23 325120 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2009-02-25 21:30:15 . 2009-02-25 21:30:15 11841536 ----a-w C:\WINDOWS\system32\atioglxx.dll
2009-02-25 21:30:02 . 2009-02-25 21:30:02 204800 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2009-02-25 21:29:49 . 2009-02-25 21:29:49 155648 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2009-02-25 21:29:41 . 2009-02-25 21:29:41 26112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2009-02-25 21:29:32 . 2009-02-25 21:29:32 43520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2009-02-25 21:29:15 . 2009-02-25 21:29:15 155648 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2009-02-25 21:27:41 . 2009-02-25 21:27:41 602112 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2009-02-25 21:26:17 . 2009-02-25 21:26:17 53248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2009-02-25 21:16:45 . 2009-03-23 20:24:23 3817984 ----a-w C:\WINDOWS\system32\ati3duag.dll
2009-02-25 21:09:44 . 2009-02-25 21:09:44 307200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2009-02-25 20:59:31 . 2009-03-23 20:24:23 2670080 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2009-02-25 20:58:44 . 2009-02-25 20:58:44 887724 ----a-w C:\WINDOWS\system32\ativva6x.dat
2009-02-25 20:58:44 . 2009-02-25 20:58:44 3107788 ----a-w C:\WINDOWS\system32\ativva5x.dat
2009-02-25 20:44:29 . 2009-02-25 20:44:29 49664 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2009-02-25 20:40:20 . 2009-02-25 20:40:20 475136 ----a-w C:\WINDOWS\system32\atikvmag.dll
2009-02-25 20:38:47 . 2009-02-25 20:38:47 126976 ----a-w C:\WINDOWS\system32\atiadlxx.dll
2009-02-25 20:38:37 . 2009-02-25 20:38:37 17408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2009-02-25 20:37:46 . 2009-02-25 20:37:46 53248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2009-02-25 20:35:08 . 2009-02-25 20:35:08 290816 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2009-02-25 20:32:59 . 2009-02-25 20:32:59 45056 ----a-w C:\WINDOWS\system32\aticalrt.dll
2009-02-25 20:32:53 . 2009-02-25 20:32:53 45056 ----a-w C:\WINDOWS\system32\aticalcl.dll
2009-02-25 20:32:05 . 2009-03-23 20:24:23 626688 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2009-02-25 20:30:01 . 2009-02-25 20:30:01 3227648 ----a-w C:\WINDOWS\system32\aticaldd.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-22_23.00.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-24 13:31:14 . 2009-05-24 13:31:14 16384 C:\WINDOWS\temp\Perflib_Perfdata_4c0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 08:13:20 152872]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 12:32:32 1312256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2008-12-04 14:02:40 182936]
"F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2008-12-04 13:59:20 957024]
"SweetIM"="C:\Program Files\SweetIM\Messenger\SweetIM.exe" [2009-03-05 17:36:00 111928]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-11-26 12:54:22 1629480]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-11-26 12:54:02 1057064]
"PAC7302_Monitor"="C:\WINDOWS\PixArt\PAC7302\Monitor.exe" [2006-11-03 09:01:16 319488]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2009-03-27 08:03:00 13684736]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2009-03-27 08:03:00 86016]
"RTHDCPL"="RTHDCPL.EXE" - C:\WINDOWS\RTHDCPL.exe [2009-01-11 13:22:44 16342528]
"nwiz"="nwiz.exe" - C:\WINDOWS\system32\nwiz.exe [2009-03-27 08:03:00 1657376]

C:\Documents and Settings\Mirek\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Secunia PSI.lnk - C:\Program Files\Secunia\PSI\psi.exe [2009-3-24 748840]

C:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-6-7 553021]
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 21:19:02 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\ICQ6.5\\ICQ.exe"=
"C:\\WINDOWS\\system32\\WgaTray.exe"=
"C:\\WINDOWS\\system32\\wscntfy.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 fsbts;fsbts;C:\WINDOWS\system32\drivers\fsbts.sys [31.3.2009 21:15:27 33408]
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [31.3.2009 21:15:20 79872]
R1 F-Secure HIPS;F-Secure HIPS Driver;C:\Program Files\F-Secure\HIPS\drivers\fshs.sys [31.3.2009 21:14:59 67808]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\drivers\CAMTHWDM.sys [3.5.2009 21:08:20 1051136]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys [31.3.2009 21:14:44 84608]
R3 FSORSPClient;F-Secure ORSP Client;C:\Program Files\F-Secure\ORSP Client\fsorsp.exe [31.3.2009 21:15:00 55904]
R3 PSI;PSI;C:\WINDOWS\system32\drivers\psi_mf.sys [24.3.2009 13:03:08 7808]
S3 PAC7302;PAC7302 VGA USB Camera;C:\WINDOWS\system32\drivers\PAC7302.SYS [8.4.2009 17:25:11 457856]
S3 ZSMC0305;VIMICRO PC Camera 301DY;C:\WINDOWS\system32\Drivers\usbVM305.sys --> C:\WINDOWS\system32\Drivers\usbVM305.sys [?]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\win2k\fsfilter.sys [31.3.2009 21:14:44 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\win2k\fsrec.sys [31.3.2009 21:14:44 25184]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
LSP: C:\Program Files\F-Secure\FSPS\program\FSLSP.DLL
DPF: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-be ... canner.cab
.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:38:28, on 24.5.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\FSAUA\program\fsus.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9889 bytes

[Damned]

Spusť si HJT a fixni:

R3 - URLSearchHook: (no name) - - (no file)
O4 - Global Startup: Bluetooth.lnk = ?
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)

Potom zkontroluj na Virustotalu červený soubor:

C:\WINDOWS\system32\ezsidmv.dat

[miruska27]

Soubor ezsidmv.dat přijatý 2009.05.24 14:23:37 (UTC)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO


Výsledek: 0/40 (0%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: 3.
Odhadovaný čas začátku mezi 56 a 80 sekundami.
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.

Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:


Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.05.24 -
AhnLab-V3 5.0.0.2 2009.05.24 -
AntiVir 7.9.0.168 2009.05.24 -
Antiy-AVL 2.0.3.1 2009.05.22 -
Authentium 5.1.2.4 2009.05.23 -
Avast 4.8.1335.0 2009.05.24 -
AVG 8.5.0.339 2009.05.24 -
BitDefender 7.2 2009.05.24 -
CAT-QuickHeal 10.00 2009.05.23 -
ClamAV 0.94.1 2009.05.24 -
Comodo 1157 2009.05.08 -
DrWeb 5.0.0.12182 2009.05.24 -
eSafe 7.0.17.0 2009.05.24 -
eTrust-Vet 31.6.6519 2009.05.23 -
F-Prot 4.4.4.56 2009.05.23 -
F-Secure 8.0.14470.0 2009.05.23 -
Fortinet 3.117.0.0 2009.05.23 -
GData 19 2009.05.24 -
Ikarus T3.1.1.49.0 2009.05.24 -
K7AntiVirus 7.10.741 2009.05.21 -
Kaspersky 7.0.0.125 2009.05.24 -
McAfee 5625 2009.05.24 -
McAfee+Artemis 5625 2009.05.24 -
McAfee-GW-Edition 6.7.6 2009.05.24 -
Microsoft 1.4701 2009.05.24 -
NOD32 4098 2009.05.22 -
Norman 6.01.05 2009.05.22 -
nProtect 2009.1.8.0 2009.05.24 -
Panda 10.0.0.14 2009.05.24 -
PCTools 4.4.2.0 2009.05.21 -
Prevx 3.0 2009.05.24 -
Rising 21.30.62.00 2009.05.24 -
Sophos 4.42.0 2009.05.24 -
Sunbelt 3.2.1858.2 2009.05.24 -
Symantec 1.4.4.12 2009.05.24 -
TheHacker 6.3.4.3.331 2009.05.22 -
TrendMicro 8.950.0.1092 2009.05.23 -
VBA32 3.12.10.5 2009.05.24 -
ViRobot 2009.5.23.1749 2009.05.23 -
VirusBuster 4.6.5.0 2009.05.24 -
Rozšiřující informace
File size: 56 bytes
MD5...: 66f1e275392271c79e441b8f575ebbed
SHA1..: b5f94ee428dd69bbcf5135a42d065ab0f2f33f70
SHA256: 93e123069621c59363332471777e65141448cc88950c72443e2ded6a334de2f6
SHA512: aeacd94b1f1f00650408f062ced654b35774da67d2a70ee051129b17b8592d92
5aac9c41374efa81639b0cc2e2fab597ecbc1a9b7a6d1d0dd35d8ed8af6b151e
ssdeep: 3:ZNPfYnuZXj7fxTpTpq4n:zYnEXn5Npdn

PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set
-

[Damned]

Takže shrnuto, nevidím, že by si tam měl ještě nějakého šmejdíka, který by ti měl způsobovat problémy v počítači.

Jen ještě máš zbytečně spuštěné služby NERO. Ty v nastavení vypni a ve službách je zastav a přepni na ruční spouštění.